xred | f95958166440716b85faab2cedcabe6d0875b5acd5ddefedacb896f5525d913e

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Size 1.9MB
Sample260707-evt8eaex5l
SHA256 f95958166440716b85faab2cedcabe6d0875b5acd5ddefedacb896f5525d913e
MD5 3e62a69c6d68efdbe257304f1c8cb96b
SHA1 1133ad7ec0d032027a595ad58465f1d724b93d93
SHA512 cfeee4f87f32a7a690bc77f3e5be5d9690fc4193039fb53c50f6fa0722c31dad2b7c3547bbd700f7653be39e28bae98168dffa9a5592f3d7b6f79e193715b073
SSDEEP 24576:6nsJ39LyjbJkQFMhmC+6GD9E4CxsVMdvaPg6cCkqNcf02iyi6/tzhIbsmBGT2hG+:6nsHyjtk2MYC5GDzCcMdxUsZT2za
TLSH
T1AC956C27E65390BAC45332374A8BD1DB2524BB1488217E9F6FEC1C5CFB3975078292A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution xred persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Custom signature

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000243ef-29.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5068	Rundll32.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 7 IoCs

pid	Process
724	system.exe
1256	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
4252	._cache_2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
4268	Synaptics.exe
2400	Synaptics.exe
1940	._cache_Synaptics.exe
3448	._cache_Synaptics.exe

Loads dropped DLL 3 IoCs

pid	Process
4804	Rundll32.exe
5068	Rundll32.exe
5068	Rundll32.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Rundll32.exe
File opened (read-only)	\??\F:	Rundll32.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File created	C:\Windows\SysWOW64\system.exe	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
File created	C:\Windows\SysWOW64\ugmusgaa.dll	system.exe
File created	C:\Windows\SysWOW64\dftvsgaa.dll	system.exe
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AAV\CDriver.sys	Rundll32.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2240	sc.exe
1128	sc.exe
1568	sc.exe
4920	sc.exe
2456	sc.exe
876	sc.exe
3728	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1960	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
4804	Rundll32.exe
5068	Rundll32.exe
5068	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3376	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	EXCEL.EXE
1960	EXCEL.EXE
1960	EXCEL.EXE
1960	EXCEL.EXE
1960	EXCEL.EXE
1960	EXCEL.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 724	3376	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe	86
PID 724 wrote to memory of 4804	724	system.exe	87
PID 4804 wrote to memory of 1288	4804	Rundll32.exe	88
PID 4804 wrote to memory of 4916	4804	Rundll32.exe	89
PID 4804 wrote to memory of 2240	4804	Rundll32.exe	90
PID 4804 wrote to memory of 1568	4804	Rundll32.exe	91
PID 4804 wrote to memory of 3728	4804	Rundll32.exe	92
PID 4804 wrote to memory of 876	4804	Rundll32.exe	93
PID 4804 wrote to memory of 2456	4804	Rundll32.exe	94
PID 4804 wrote to memory of 4920	4804	Rundll32.exe	95
PID 4804 wrote to memory of 3376	4804	Rundll32.exe	85
PID 4804 wrote to memory of 724	4804	Rundll32.exe	86
PID 4804 wrote to memory of 1288	4804	Rundll32.exe	88
PID 4804 wrote to memory of 4916	4804	Rundll32.exe	89
PID 4804 wrote to memory of 2240	4804	Rundll32.exe	90
PID 4804 wrote to memory of 1568	4804	Rundll32.exe	91
PID 4804 wrote to memory of 3728	4804	Rundll32.exe	92
PID 1288 wrote to memory of 4900	1288	net.exe	104
PID 4916 wrote to memory of 4648	4916	net.exe	105
PID 4804 wrote to memory of 1128	4804	Rundll32.exe	106
PID 724 wrote to memory of 5068	724	system.exe	108
PID 3376 wrote to memory of 1256	3376	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe	121
PID 1256 wrote to memory of 4252	1256	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe	122
PID 1256 wrote to memory of 4268	1256	2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe	124
PID 4268 wrote to memory of 1940	4268	Synaptics.exe	127
PID 2400 wrote to memory of 3448	2400	Synaptics.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\SysWOW64\system.exe
  C:\Windows\system32\system.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\ugmusgaa.dll Exbcute
    3⤵
    - Checks computer location settings
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\SysWOW64\net.exe
      net stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1288
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WinDefend
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
  - - C:\Windows\SysWOW64\net.exe
      net stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4916
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2240
  - - C:\Windows\SysWOW64\sc.exe
      sc config MpsSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1568
  - - C:\Windows\SysWOW64\sc.exe
      sc stop ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3728
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ZhuDongFangYu
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:876
  - - C:\Windows\SysWOW64\sc.exe
      sc stop 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2456
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360rp
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4920
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" stop PolicyAgent
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1128
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32 C:\Windows\system32\dftvsgaa.dll Exbcute
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5068
- C:\Users\Admin\AppData\Local\Temp\2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4252
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1940

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3448

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

._cache_2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Size 986KB
SHA256 94cf90ee381eeee9bb51006a458c17a61dbbf24722ef3398806b66c8e25aca82
MD5 0603319fffdb927e0030599b5b6f8da2
SHA1 b0cc8de6c36ef33f4ab7e7bb2147afedec51323f
SHA512 de8cecb9cae2c0ca1e1b0f7c9fa60f9a86d27c3e80a08ce2540a74eed319f8f764e2fbda4c657cdaaa8ce98f6369dd884797f79656b14eecd87c18f35b4c759f
SSDEEP 24576:l4CxsVMdvaPg6cCkqNcf02iyi6/tzhIbsmBGT2:2CcMdxUsZT2
TLSH
T11425C8679A5391FAC8433273068794DF3624A704C4217EAF9DAC1CACFB39710796D2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_3e62a69c6d68efdbe257304f1c8cb96b_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
Size 1.7MB
SHA256 661a58a24a2fdc06a3f588529319fba48145305d6fbb26f7c898a982c61d0360
MD5 9a274662d9c041454a55276865b496a1
SHA1 2118671fdd5bf56764991c6625ac47c2f0ab6980
SHA512 ddac99102efc79b41a2cdb771df753cd3be81c81f5196ab92f831f5adec5764f8cdd9f4116d0e83b0dbf26b1dd6886acb12a9eb10efc0d8ad27856eab171257e
SSDEEP 24576:6nsJ39LyjbJkQFMhmC+6GD9E4CxsVMdvaPg6cCkqNcf02iyi6/tzhIbsmBGT2y:6nsHyjtk2MYC5GDzCcMdxUsZT2y
TLSH
T196854C67A69390BAC45333374A8B91DB2534B70488307E9F6EEC1C5CFB3975079292A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4D295E00

Path C:\Users\Admin\AppData\Local\Temp\4D295E00
Size 23KB
SHA256 0c87cf5e33119be43102572fee4e0df6cd4c34b4c7b89b473b3961e9798c27b0
MD5 26f97d58e0bdfdee6361dff94c85eb7d
SHA1 4cac41581fd44ff774c0b591e47f6309773359c3
SHA512 af544a3b3c25de1ddcb949c46173e1676e64c633f1db045e69d1f41e0536e1289828d207f573f1da8e18e533b7136d5c450d7b8f4d6f6f0f59924cc77e9b06b6
SSDEEP 384:MQrwUoqFU2p+o5bKmm/S4TH3ifGBJ/VI+ETOwsIP1xiS3v4CXxx6W:M2wJqFj4o5bhm/1H3ifU/ZETVzDXgCXp
TLSH
T1E3B2C00FDE3E5D6BE6B25C3D810DB7A6D71037406A04D69B6441A28E1A47EE7136F08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5232.tmp

Path C:\Users\Admin\AppData\Local\Temp\5232.tmp
Size 4.3MB
SHA256 58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705
MD5 6c7cdd25c2cb0073306eb22aebfc663f
SHA1 a1eba8ab49272b9852fe6a543677e8af36271248
SHA512 17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6
SSDEEP 98304:U+VAwiFxfTTITz+DjHWtIXS3k/8HqoVN:nAwiDTqz+DjHWtIXS3k/8HqoV
TLSH
T127268E5167FA5799F7F35A3469B865658CBABC32ED21CB8D0252100A09B2E81CF74F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wyFMRgrQ.xlsm

Path C:\Users\Admin\AppData\Local\Temp\wyFMRgrQ.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dftvsgaa.dll

Path C:\Windows\SysWOW64\dftvsgaa.dll
Size 24KB
SHA256 6e7c04e90d3c42bc9af95eb5b03c60664fc812a62129a578906aa3d9b9be1664
MD5 66ed0210db83ddb4b2ba9128d19fdd2a
SHA1 a512e102bae54b299c90de3f3fb01184ad0bfd2e
SHA512 6fda543bdacecacd6aa1eb66a4b84a9aa49a23f212c4e0c36dcbf725a0739c5843c29465daca248679368057bfa208b67d764e9cd3844ba39a94c7283c5d7de0
SSDEEP 384:deNKXvoxOHye5RizkpgYiAOu86/0WhRR4u20bD0MR9CHom9W50e:deNK/oYyeuAyYN8oMu2GDrCHIie
TLSH
T157B2B3A4FB4EED21E19640B63264EB7A64486930578FB0D3F7C34E5155342E0AA7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.exe

Path C:\Windows\SysWOW64\system.exe
Size 180KB
SHA256 46c06dd866f383c20b06761471a362d4fda0746febad27eaf887905011867f6f
MD5 99a16b42e72e7c35319ded4d3d5855e5
SHA1 90874ed400dc698523bcdfa56dc30f18a3091297
SHA512 7de0fb9c597f45f1d10c98732adeb884a5df81ed926c33c03e27998c36d48d4f3295bfef8a33574f08158a7e47d4c357af992ef64a7f4dc15277874730bbb713
SSDEEP 3072:T2Tbs/GSEdX6Pi7U0SJVnBOyYN8u2r91szoI7h+aS1G5:q5SEkJVnB+2Uzo0naG5
TLSH
T1ED048D04F741DD32C4C100BE6175D772652D6A325B9F90A3B7DA1F6ABB302E2AA39707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ugmusgaa.dll

Path C:\Windows\SysWOW64\ugmusgaa.dll
Size 77KB
SHA256 0018ee5ad65eda4843d24464fc41ecda9ae3e051aab404f3e6c4215940168c21
MD5 02fc7f52c9bc1141c0897c985fea35a6
SHA1 eba3456099c844eaa2b912c5af9ff3329d887b67
SHA512 cd586c85b2652bbcd1a41ff2c4c5fbf06a28791139e9e0306d6b8f934cf4df0ea78dbd1ddbe56cfaf5409767dea9b009f39454abf1c9ee1959f965153811ea7a
SSDEEP 1536:He1LerP4LPg1we6+EX6Pi7U02rd9cqCmh6DY5atOXPQj:HGSEdX6Pi7U0SJV
TLSH
T15B731744F301CD36C9D004BE6261D372751D6A32AB9FA4B377DA1E5AB7302F3A629706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1256-139-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/1940-214-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/1960-215-0x00007FFD75220000-0x00007FFD75230000-memory.dmp

Download

memory/1960-217-0x00007FFD75220000-0x00007FFD75230000-memory.dmp

Download

memory/1960-205-0x00007FFD77550000-0x00007FFD77560000-memory.dmp

Download

memory/1960-203-0x00007FFD77550000-0x00007FFD77560000-memory.dmp

Download

memory/1960-202-0x00007FFD77550000-0x00007FFD77560000-memory.dmp

Download

memory/1960-206-0x00007FFD77550000-0x00007FFD77560000-memory.dmp

Download

memory/1960-201-0x00007FFD77550000-0x00007FFD77560000-memory.dmp

Download

memory/2400-213-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/3376-0-0x0000000000400000-0x00000000005E9000-memory.dmp

Download

memory/3376-32-0x0000000000400000-0x00000000005E9000-memory.dmp

Download

memory/3376-9-0x0000000000710000-0x0000000000711000-memory.dmp

Download

memory/3448-218-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/4252-141-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/4268-219-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/4268-270-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/4268-272-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/4268-293-0x0000000000400000-0x00000000005B9000-memory.dmp

Download